Round 2: DDoS Versus Wikileaks

In the second round of what may possibly be a protracted Internet skirmish, a denial of service attack briefly blocked access to the cablegate.wikileaks.org web site this morning around 8:00 am EST. On twitter, Wikileaks pegged the DDoS as exceeding 10 Gbps (significantly larger than my 2-4 Gbps estimate for the first round of attacks on Sunday).

As compared with this Sunday’s initial attack (blog analysis available here), ATLAS data from 110 providers around the world suggest today’s DDoS was both larger and more sophisticated. Specifically, today’s attack involved several different components, including a low bandwidth application level DDoS and a 2-3 Gbps Syn attack against the primary “cablegate” IP addresses (the hosted web site is load balanced across data center locations in Europe and the US West Coast).

An example of one of the anonymous alerts ATLAS collected yesterday is shown below. This alert is for a modest TCP Syn attack against cablegate.wikileaks.org targeting high number ports. The source address blocks are anonymized with XX replacing the high number bits.

In the below chart, I graph traffic from 110 ATLAS carriers around the world to address blocks (BGP prefixes) used by Wikileaks. Note these address blocks may also include traffic to other customer using the same hosting provider. The attack began around 7am EST though a smaller traffic spike occurs around 2am. All times are EST. At the time of this blog posting, the DDoS is still ongoing though not significantly impacting Wikileaks access.

Based on Netcraft and other reports, the outage was brief though cablegate web site performance was moderately impacted throughout the day.

Interestingly, the attack appears to originate from a relatively small number of source IPs, including machines in Russia, eastern Europe and Thailand.

23 Responses to “Round 2: DDoS Versus Wikileaks”

Interesting. Is there anyway the countries are off and they are all really coming from the US? Is there a way they can hide where they are actually coming from?

November 30, 2010 at 11:24 pm, manny said:

Nicky: you be they do.

The military calls it Cyberwarfare for a reason.

December 01, 2010 at 3:53 am, KristoferA said:

Russia, Eastern Europe, Thailand… what do these countries have in common? Lots of people using pirated versions of Windows etc that are readily available to purchase on DVDs/CDs. The pirate discs are often contaminated with all kinds of junk/spyware/crapware so those countries are self-made botnets. The real origin of the traffic is most likely elsewhere…

December 01, 2010 at 10:58 am, Vico said:

Actually, Wikileaks is just becoming a target that many different botnet masters are targeting for fun. Because WikiLeaks is in the news it’s “cool” to attack them and see how strong your army is.

“The Jester was angry enough with militants recruiting for jihad and about the WikiLeaks disclosures to launch a DoS attacks on their sites, so why was he not very peeved about an impostor using his name to scam money? The logical conclusion might be that The Jester himself is the hoaxer…”

[…] has been massive and orchestrated attack on the hosting of Wikileaks files, from a distributed denial of service, to Amazon dumping […]

December 04, 2010 at 1:45 pm, TheJesterFesters said:

Craig – if you watch the video’s of thejester’s xerxes DOS – one known source of the DOS attacks – you might notice that the news gadget on the sidebar of his Ubuntu desktop is showing news in Cyrillic script – Russian I believe. Rookie mistake on his part.

[…] of documents to major global newspapers, the site has been besieged by DDOS attacks (upwards of 10 Gbps at one point), forcing the site offline and hampering its ability to deliver data. After moving to […]

December 07, 2010 at 4:00 am, The Weakest Link: What Wikileaks Has Taught Us About the Open Internet | TECHNOLOGY NEWS said:

[…] of documents to major global newspapers, the site has been besieged by DDOS attacks (upwards of 10 Gbps at one point), forcing the site offline and hampering its ability to deliver […]

[…] eastern Europe and Thailand, says Craig Labovitz of Arbor Networks in Ann Arbor, Michigan, who has been tracking the attacks. It is likely that the machines sending the traffic are being secretly controlled by a hacker […]

[…] government sponsored attack on Wikileaks was done by Arbor Networks and it can be read here. Wikileaks Blog Post by Arbor Networks. Despite the attacks, the Wikileaks mirror sites are springing up everywhere. The official website […]

[…] government sponsored attack on Wikileaks was done by Arbor Networks and it can be read here. Wikileaks Blog Post by Arbor Networks. Despite the attacks, the Wikileaks mirror sites are springing up everywhere. The official website […]

[…] Now to put this in some perspective with recent events, Arbor Networks estimates that the DDoS attacks that took WikiLeaks down on the day the cables were released were around 2-4 Gbps, just slightly above the average DDoS attack. But two days later, another attack on the site clocked in around 10 Gbps. […]

[…] were made with less than 1 Gigabit per second (Gbps). Sure, some attacks, like the one that got WikiLeaks in 2010 used 10Gbps level attacks, but, really, you donâ€™t need to that much traffic to knock the stuffings out of a Web […]

Subscribe to this blog

First Name*

Last Name*

Company*

Email*

Phone

This field is for validation purposes and should be left unchanged.

Asert

Arbor’s Security Engineering & Response Team (ASERT) delivers world-class network security research and analysis for the benefit of today’s enterprise and network operators. ASERT engineers and researchers are part of an elite group of institutions that are referred to as ‘super remediators’ and represent the best in information security. ASERT has both visibility and remediation capabilities at nearly every tier one operator and a majority of service provider networks globally.

ASERT shares operationally viable intelligence with hundreds of international Computer Emergency Response Teams (CERTs) and with thousands of network operators via in-band security content feeds. ASERT also operates the world’s largest distributed honeynet, actively monitoring Internet threats around the clock and around the globe.

Arbor Networks has collaborated with Jigsaw (formerly Google Ideas) to create a data visualization that shows how Distributed Denial of Service (DDoS) attacks have become a global problem. The data is updated daily from Arbor’s global network of sensors and can be viewed at www.digitalattackmap.com